release: PRFlow v2.38.2 — a fork can pass the release check

[The01Geek]

Generated release candidate. Nothing here is authored by hand — every byte is produced by the deterministic exporter from one private source commit.

source_commit:   82b6b43fe40fd445af7806335505152270e01edb
ARTIFACT_DIGEST: 3f0372a06af3c6acfcb34514b520fd4afc609e07d037ea8c881e62be909ee63f
files:           438

What ships

• A pull request from a fork can pass the required check. Artifact verification is skipped for an ordinary pull request; that exemption was gated on the pull request coming from this repository, so a fork was verified against the digest manifest instead and failed on every file it changed. An outside contributor saw a red required check they could do nothing about.
• A tree carrying no provenance is refused. The guard rejecting a missing .release/source.json keyed on the branch name alone, and a push carries main — so deleting that one file reported the whole check as passing, on the published branch.
• CONTRIBUTING.md now tells a contributor what the required check does and does not say about their change.
• Release notes for both fixes, and a correction to the v2.38.1 entry that claimed "a fork always takes the strict path" — no longer true, and over-stated when written.

The workflow change itself already landed as policy-update #2146; this release regenerates .release/ for it, which is what clears the failing check that PR left on main by design.

Gates

gate	result
two independent exports byte-identical	pass
judge bytes identical to base main	pass — both files
verifier against the candidate	pass — 438 files
private CI on the source commit	gating this merge

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
pr-flow	🟢 Ready	View Preview	Aug 29, 2026, 11:47 PM

💡 Tip: Enable Workflows to automatically generate PRs for you.